{"id":114795,"date":"2024-04-05T00:25:42","date_gmt":"2024-04-04T22:25:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-12-s-ustraneniem-4-uyazvimostej"},"modified":"2024-04-05T00:25:42","modified_gmt":"2024-04-04T22:25:42","slug":"obnovlenie-x-org-server-21-1-12-s-ustraneniem-4-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-x-org-server-21-1-12-s-ustraneniem-4-uyazvimostej","title":{"rendered":"X.Org Server 21.1.12 v\u00e4rskendus, mis parandab 4 haavatavust","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Avaldatud on korrigeerivad v\u00e4ljundid X.Org Server 21.1.12 ja DDX-komponent (seadmest s\u00f5ltuv X) xwayland 23.2.5, mis v\u00f5imaldab X.Org Serveri k\u00e4ivitamist X11 rakenduste k\u00e4itamiseks Waylandi baasil. Uues versioonis X.Org Server on k\u00f5rvaldatud 4 haavatavust. \u00dcks haavatavus v\u00f5ib avaldada m\u00f5ju privileegide t\u00f5stmisele s\u00fcsteemides, kus X-server t\u00f6\u00f6tab root-kasutaja \u00f5igustes, samuti kaugkoodide k\u00e4itamisele konfiguratsioonides, kus juurdep\u00e4\u00e4s saavutatakse X11 sessiooni edastamise kaudu SSH abil.       <\/p>\n<p>\u00dclej\u00e4\u00e4nud kolm haavatavust v\u00f5ivad viia m\u00e4lusisalduse lekkimiseni <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-los-angeles\/\"   title=\"serverilt\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3610\">serverilt<\/a> v\u00f5i ootamatule katkestamisele. Need kolm haavatavust kasutavad \u00e4ra kliendi poolel muud baiti j\u00e4rjekorra kasutamist kui <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-dronten\/\"   title=\"serveris\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2580\">serveris<\/a>. Seoses sellega on uues v\u00e4ljaandes pakkuda v\u00f5imalust blokeerida klientide \u00fchendusi s\u00fcsteemidega, millel on erinev baitide j\u00e4rjekord. \u00dchenduse keelamiseks saab kasutada konfiguratsiooni parameetrit \u201eAllowByteSwappedClients\u201d v\u00f5i k\u00e4surida valikut \u201e+byteswappedclients\u201d.    <\/p>\n<p>Olekutingimuse muutmine v\u00f5imaldab kaitsta v\u00f5imalike seni avastamata haavatavuste eest, mis manipuleerivad baitide j\u00e4rjekorraga. Selliste haavatavuste olemus seisneb selles, et baitide j\u00e4rjekorra muutmine suuruse poolest viib nende vale t\u00f5lgendamiseni ja lugemiseni v\u00f5i kirjutamiseni m\u00e4llu, mis \u00fcletab selgelt eraldatud puhvri suuruse.    <\/p>\n<p>Vaikimisi j\u00e4\u00e4b siiski alles toetus klientidele, millel on erinev baitide j\u00e4rjekord, hoolimata sellest, et praktikas on baitide j\u00e4rjekorra muutmine viimase ajal \u00e4\u00e4rmiselt haruldane, kuna t\u00f6\u00f6jaamad, millel X-server t\u00f6\u00f6tab, on reeglina varustatud little-endian (v\u00e4iksemast suuremale) baitide j\u00e4rjekorraga protsessoritega ning nendele \u00fchendatavad X-kliendid, millel on big-endian j\u00e4rjekord, nagu s390x (IBM zSystems) platvorm, on suur haruldus.       <\/p>\n<p>Tuvastatud probleemid:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 \u2014 andmete lugemine m\u00e4lust v\u00e4ljaspool puhverdust funktsioonide ProcXIGetSelectedEvents, ProcXIPassiveGrabDevice ja ProcAppleDRICreatePixmap manipuleerimise kaudu, mis kasutavad v\u00e4ljakutse saatja poolt edastatud v\u00e4\u00e4rtuse baitide j\u00e4rjekorrast s\u00f5ltumatut suuruse v\u00e4ljakutset. Vastavalt sellele, kui kliendi ja serveri baitide j\u00e4rjestus on erinev, tagastavad funktsioonid kliendile rohkem andmeid. Esimesed kaks probleemi ilmnevad alates xorg-server-1.7.0 v\u00e4ljalaskest (2009. aasta), kolmas aga alates xorg-server-1.15.0 (2012. aasta).\n<li class=\"l\"> CVE-2024-31083 \u2014 t\u00fchistatud m\u00e4lule (User-after-free) viitamine funktsioonis ProcRenderAddGlyphs, mis kutsub v\u00e4lja funktsiooni AllocateGlyph() uute gl\u00fc\u00fcfide s\u00e4ilitamiseks, mida klient edastab. Funktsioon AllocateGlyph() tagastab uue gl\u00fc\u00fcfi nullindikaatoriga (refcount=0), ja gl\u00fc\u00fcfi uuesti viitamine ei suurenda viidete arvu, mist\u00f5ttu gl\u00fc\u00fcfi uus massiiv v\u00f5ib sisaldada mitut viidat, mis osutab \u00fchele gl\u00fc\u00fcfile, millel ei ole viidete arvu. Kui funktsioon ProcRenderAddGlyphs vabastab m\u00e4lu, mis on eraldatud gl\u00fc\u00fcfile, j\u00e4\u00e4b massiivi ja v\u00f5ib kasutada \u00fcleliigne gl\u00fc\u00fcfi viit, mille m\u00e4lumaht on juba vabastatud. Probleem ilmneb X.Org serveris ega m\u00f5juta xwayland'i.        <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60927\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 X.Org Server 21.1.12 \u0438 DDX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 (Device-Dependent X) xwayland 23.2.5, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a X.Org Server \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f X11-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 Wayland. \u0412 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 X.Org Server \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 4 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u041e\u0434\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 X-\u0441\u0435\u0440\u0432\u0435\u0440 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114795","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 X.Org Server 21.1.12 \u0438 DDX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 (Device-Dependent X) xwayland 23.2.5, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a X.Org Server \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f X11-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-x-org-server-21-1-12-s-ustraneniem-4-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 X.Org Server 21.1.12 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 4 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 X.Org Server 21.1.12 \u0438 DDX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 (Device-Dependent X) xwayland 23.2.5, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a X.Org Server \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f X11-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-x-org-server-21-1-12-s-ustraneniem-4-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-04-04T22:25:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-04-04T22:25:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47X.Org Server 21.1.12 v\u00e4rskendus, mis k\u00f5rvaldab 4 haavatavust | ProHoster","description":"Avaldatud parandavad v\u00e4ljalasked X.Org Server 21.1.12 ja DDX-komponendi (Device-Dependent X) xwayland 23.2.5, mis v\u00f5imaldab X.Org Serveri k\u00e4ivitamist, et teostada X11 rakendusi baasesendites.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-x-org-server-21-1-12-s-ustraneniem-4-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 X.Org Server 21.1.12 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 4 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 X.Org Server 21.1.12 \u0438 DDX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 (Device-Dependent X) xwayland 23.2.5, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a X.Org Server \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f X11-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/obnovlenie-x-org-server-21-1-12-s-ustraneniem-4-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-04T22:25:42+00:00","article:modified_time":"2024-04-04T22:25:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114795","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:41:47","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 21:25:22","updated":"2026-02-22 15:41:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114795","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=114795"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114795\/revisions"}],"predecessor-version":[{"id":162137,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114795\/revisions\/162137"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=114795"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=114795"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=114795"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}